1. Technical Field
The present invention relates to a detecting apparatus, system, program, and detecting method for detecting the degree of correlation between first events and second events repeatedly occurring in an observed apparatus.
2. Description of the Related Art
One known method for verifying hardware includes observing signals output from hardware to be verified with a device such as a logic analyzer. A known method for verifying software includes using a device such as a tracer that sequentially executes executable codes of software to be verified. A known method for verifying software and hardware includes sequentially recording state changes of software or hardware to be verified and performing verification based on information on the statistically processed records.
Known prior art describes a method including making an investigation on a statistical distribution of events in a normal state and determining a theoretical statistical distribution based on the observed values for increasing the accuracy of detecting abnormal events. Additional, a debugging apparatus has been described that uses events generated by the apparatus itself to reproduce execution of parallel programs and to increase the efficiency of debugging. Also described is a program that detects an event occurrence pattern from an event log based on information on a plurality of relationships defined between events and outputs the detected event occurrence pattern.
In the verification methods using a logic analyzer or a tracer, an enormous amount of results are output if the size of hardware or software to be verified is large. Therefore, these methods require predicting and registering bugs that might occur and sequentially deleting output results irrelevant to the registered bugs. Accordingly, this does not achieve efficient verification. In the verification methods using statistical information, it is difficult to analyze correlations between events. In addition, since the verification methods using statistical information require sequentially recording state changes of software or hardware, they require a large memory area if the software or hardware is operated for a long term.
Takemori, et al., “Modeling Techniques About Statistical Theory of Attack Events”, The Institute of Electronics, Information and Communications Engineers, published March 2004, describes a method that requires preliminary modeling a statistical distribution of attack events (abnormal events). The debugging apparatus described above requires generating events by the apparatus itself and causing the events to be executed by parallel programs to be debugged.
The program described above requires obtaining the occurrence time of events and also involves complicated processing. In addition, the program excludes occurrence patterns of infrequent events. Therefore, occurrence patterns likely to include bugs are excluded, so that reliable verification cannot be accomplished.